chore(deps-dev): pi 1.0.2 + 4 patch bumps; make package-lock.json the only lockfile

.github/dependabot.yml

@@ -1,5 +1,7 @@
 version: 2
 updates:
+  # Updates package.json and package-lock.json, the only lockfile. CI and
+  # bun-based installs read package-lock.json, so nothing else can drift.
   - package-ecosystem: npm
     directory: /
     schedule:

.github/workflows/ci.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           bun-version: 1.4.2
 
+      # package-lock.json is the only lockfile. Bun installs from it, and
+      # --frozen-lockfile fails when it is out of date with package.json.
       - name: Install dependencies
         run: bun install --frozen-lockfile
 

.gitignore

@@ -1,4 +1,7 @@
 node_modules/
+# package-lock.json is the only lockfile; bun installs from it (see AGENTS.md)
+bun.lock
+bun.lockb
 dist/
 coverage/
 *.log

AGENTS.md

@@ -53,4 +53,4 @@ Per-rule body cap: 12,000 chars. Total injected per tool result: 40,000 chars. C
 4. Create GitHub Release (`gh release create v<version>`).
 5. CI auto-publishes to npm via OIDC trusted publishing.
 
-Dev toolchain is Bun 1.4.2 (`bun install`, `bun run check`, `bun run test`). Keep `package-lock.json` so npm consumers can `npm ci`.
+Dev toolchain is Bun 1.4.2 (`bun install`, `bun run check`, `bun run test`). `package-lock.json` is the only lockfile: npm consumers `npm ci` from it, and Bun installs from it too (`bun install --frozen-lockfile` fails when it is out of date). `bun.lock` is gitignored; never commit one. Change dependencies with `npm install <pkg>@<version>` so `package-lock.json` is regenerated.

CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Docs: install from GitHub instead of npm.
 - CI: publish skips without a configured token.
+- Dev dependencies: `@earendil-works/pi-coding-agent` and `@earendil-works/pi-tui` 1.0.2 for tests (from 0.87.1), `@biomejs/biome` 2.5.15, `@types/node` 26.6.4, `vitest` 5.0.3.
+- `package-lock.json` is now the only lockfile. `bun.lock` is removed and gitignored; Bun installs from `package-lock.json`, so Dependabot updates can no longer leave a second lockfile stale.
 
 ## [0.2.0] - 2026-09-24
 

CONTRIBUTING.md

@@ -14,6 +14,8 @@ npm pack --dry-run          # release sanity
 
 `npm ci && npm test` remains the consumer smoke (extension hosts install with npm).
 
+`package-lock.json` is the only lockfile; `bun install` reads it and `bun.lock` is gitignored. To change a dependency, run `npm install <pkg>@<version>` and commit the updated `package-lock.json`.
+
 If you change rule discovery, precedence, injection format, or TUI behavior, also update `README.md` and add tests.
 
 Tests follow `#given X #when Y #then Z` naming with `// given / // when / // then` body comments.

README.md

@@ -190,7 +190,7 @@ Rule files are prompt and context input. Do NOT load untrusted repositories. All
 ```bash
 git clone https://github.com/code-yeongyu/pi-rules
 cd pi-rules
-bun install            # install dev + peer deps (Bun 1.4.2)
+bun install            # install dev + peer deps from package-lock.json (Bun 1.4.2)
 bun run test           # unit tests
 bun run test:integration
 bun run check          # tsgo + biome